Skip to main content

Linux Kernel EUVDEUVD-2026-25473

| CVE-2026-31580 HIGH
Use After Free (CWE-416)
2026-04-24 Linux GHSA-g664-f62x-2rfm
Denial Of Service Linux Use After Free Memory Corruption
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local low-priv trigger (AV:L/PR:L); race between device free and in-flight superblock write makes reliable triggering high-complexity (AC:H); kernel UAF yields full C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 03:03 vuln.today
CVSS changed
Apr 27, 2026 - 20:37 NVD
7.8 (HIGH)
Patch released
Apr 27, 2026 - 20:29 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25473
CVE Published
Apr 24, 2026 - 14:42 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

bcache: fix cached_dev.sb_bio use-after-free and crash

In our production environment, we have received multiple crash reports regarding libceph, which have caught our attention:

[6888366.280350] Call Trace:
[6888366.280452]  blk_update_request+0x14e/0x370
[6888366.280561]  blk_mq_end_request+0x1a/0x130
[6888366.280671]  rbd_img_handle_request+0x1a0/0x1b0 [rbd]
[6888366.280792]  rbd_obj_handle_request+0x32/0x40 [rbd]
[6888366.280903]  __complete_request+0x22/0x70 [libceph]
[6888366.281032]  osd_dispatch+0x15e/0xb40 [libceph]
[6888366.281164]  ? inet_recvmsg+0x5b/0xd0
[6888366.281272]  ? ceph_tcp_recvmsg+0x6f/0xa0 [libceph]
[6888366.281405]  ceph_con_process_message+0x79/0x140 [libceph]
[6888366.281534]  ceph_con_v1_try_read+0x5d7/0xf30 [libceph]
[6888366.281661]  ceph_con_workfn+0x329/0x680 [libceph]

After analyzing the coredump file, we found that the address of dc->sb_bio has been freed. We know that cached_dev is only freed when it is stopped.

Since sb_bio is a part of struct cached_dev, rather than an alloc every time. If the device is stopped while writing to the superblock, the released address will be accessed at endio.

This patch hopes to wait for sb_write to complete in cached_dev_free.

It should be noted that we analyzed the cause of the problem, then tell all details to the QWEN and adopted the modifications it made.

AnalysisAI

Local privilege escalation and denial of service in the Linux kernel's bcache subsystem stems from a use-after-free of the cached_dev.sb_bio structure; if a cached backing device is stopped while a superblock write is in flight, the freed bio is dereferenced at I/O completion (endio), corrupting kernel memory. Affected systems are those running bcache-backed block devices (observed crashing via librbd/libceph rbd workloads), where a local user with the ability to trigger device teardown during superblock activity can crash the host or potentially corrupt kernel memory. This carries no public exploit identified at time of analysis and an EPSS of just 0.02%, consistent with a hard-to-time race rather than a readily weaponized flaw.

Technical ContextAI

bcache is the Linux kernel block-layer caching driver that lets a fast SSD cache a slower backing device; it is compiled into or loaded as part of the kernel block subsystem (CPE cpe:2.3:a:linux:linux). The struct cached_dev embeds sb_bio inline (not allocated per-write), and the superblock write path (__write_super/sb_write) issues this bio asynchronously with a completion callback. The root cause is CWE-416 (Use-After-Free): cached_dev_free() can release the containing cached_dev while an outstanding sb_bio superblock write has not yet completed, so the endio handler later touches freed memory. The fix makes cached_dev_free() wait for the pending sb_write to finish before freeing, closing the race between device stop and superblock write completion.

RemediationAI

Vendor-released patch: upgrade to a fixed Linux kernel - 6.12.83, 6.18.24, 6.19.14, or 7.0.1 or later - matching your stable series, or apply the upstream stable commits (add4982510f3, 2d6965581e16, 4f71c8ba2dc0, 383f7fec0de8) via https://git.kernel.org/stable/. Distribution users should apply their vendor kernel update, e.g. per Ubuntu USN-8488-1 (https://ubuntu.com/security/notices/USN-8488-1), and reboot to load the patched kernel. Where immediate patching is not possible and bcache is not required, the most effective compensating control is to avoid using bcache entirely (do not build the caching stack on bcache), since the bug only manifests on bcache-backed devices; the trade-off is loss of SSD caching acceleration. If bcache must remain in use, operationally avoid stopping/detaching cached backing devices under active I/O and minimize configuration-driven superblock writes during teardown, accepting that this only narrows - not eliminates - the race window.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-25473 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy